shopify-webhooks

name	shopify-webhooks
description	Receive and verify Shopify webhooks. Use when setting up Shopify webhook handlers, debugging signature verification, or handling store events like orders/create, products/update, or customers/create.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Shopify Webhooks

When to Use This Skill

• Setting up Shopify webhook handlers
• Debugging signature verification failures
• Understanding Shopify event types and payloads
• Handling order, product, or customer events

Verification (core)

Shopify signs the raw body with HMAC-SHA256 keyed on the app's API secret and sends the digest in X-Shopify-Hmac-SHA256 as base64 (not hex). Pass the raw body, decode base64, and compare timing-safe. The topic is in X-Shopify-Topic; the shop domain in X-Shopify-Shop-Domain.

Node:

const crypto = require('crypto');

function verify(rawBody, hmacHeader, secret) {
  if (!hmacHeader)  ;
   expected = crypto.(, secret).(rawBody).();
   {
     crypto.(.(hmacHeader), .(expected));
  }  {
     ;
  }
}